If this is your first visit, be sure to
check out the FAQ by clicking the
link above. You may have to register
before you can post: click the register link above to proceed. To start viewing messages,
select the forum that you want to visit from the selection below.

Top 10 Web App Vulnerabilities

February 3, 2003
Top 10 Web App Vulnerabilities

By Timothy Dyck

The Open Web Application Security Project, a collaborative security education site, has released a list of the top 10 vulnerabilities in Web applications. The list, at www.owasp.org , is clearly written and full of real problems?with a variety of matching solutions. Here's the vulnerabilities list followed by eWEEK Labs' recommendations.

1. Unvalidated Parameters

Nothing client computers send to Web applications should be accepted without validating the input. Input should be scanned two ways: First, input strings should get a low-level scrubbing using regular expressions or checks against enumerated values; second, application-level checks should be performed on input data.

2. Broken Access Control

Once users have logged in, each page in the application must enforce access control rules. Do not rely solely on characteristics of the data stream to do this; application-level checks must also enforce access controls. Encrypt traffic to block replay attempts and reauthenticate users before critical tasks as a defensive measure against session hijacking.

3. Broken Account and Session Management

If attackers can access a user's session information, they can get around the whole authentication subsystem. Developers who use their own session key generation code must be able to strongly justify that decision or use the application server's session key logic.

4. Cross-Site Scripting Flaws

Parse user input to turn angle brackets (such as "<") into HTTP escape sequences to prevent scripting code from being stored on the server. Remember, ASCII characters can be encoded as Unicode to attempt to get around these checks.

5. Buffer Overflows

This is a risk only when user input is passed to components written in languages that don't have buffer overflow protection (C and C++ are the main problem languages). Avoid using these in Web application code. Keep third-party components patched.

6. Command Injection Gaps

This weakness arises when web applications pass user input to operating system programs or SQL databases without filtering out or escaping command termination or command separation characters. Attackers can then embed commands in their input; these commands will run on the Web server or database server. Databases must limit permissions of Web user log-ins.

7. Error-Handling Flaws

Never show default error messages to Web users. Intercept error conditions and display a generic message to avoid leaking information. Install an error-tracking mechanism to notice when a site is being probed for weaknesses.

8. Insecure Use of Cryptography

Every mainstream language now has strong cryptography support. Use a proven algorithm and don't store the key within source code, because source code disclosure bugs are relatively common in application severs.

9. Remote Administration Problems

Use strong authentication techniques and don't make these administration tools available remotely. If they are needed, use a virtual private network to restrict network access.

Web application firewalls
This is an emerging product category that uses stateful traffic inspection to dynamically parse and filter incoming HTTP requests, allowing only legitimate requests to pass. This is an immature market segment, but its potential effectiveness is high, and we think this approach is the way of the future.
* Sanctum's AppShield
* Stratum8 Networks Inc.'s Stratum8 Application Protection System 100
* OWASP's CodeSeeker (Version 1.0 release planned for early this year)

He shown the authors name and everything so I really don't see much of a problem here especially considering the fact that I've seen many members of AO post things from news sites and stuff all the time.